DEV Community

Discussion on: How did GraphQL become a popular way to choose what to query from an API? (Are there any other JSON/XML based implementations?)

View post

Replies for: Hi Pacharapol, it seems like (based on the latest few posts) that you're trying to understand better some concepts around API design. Let's see if ...

Collapse
 
patarapolw profile image
Pacharapol Withayasakpunt • • Edited

Thanks for that phil.tech link.

Why do you say so? GraphQL is not inherently secure.

Simply because more research (on pentesting) is being put into it.

But if you directly try to put JSON-serializable query language into Request Body, that is the path to doom.

Of course, GraphQL is always limited by the schema, but it is pretty much autogenerated in Gatsby and Hasura.

Collapse
 
rhymes profile image
rhymes •

Simply because more research (on pentesting) is being put into it.

But GraphQL has nothing in its spec that talks about security. REST is 20 years old and sits on top of a protocol that's well older. GraphQL on top of HTTP is not inherently secure. Same way REST on top of HTTP is not as well.

There's a ton of research on securing HTTP though